Adding the possibility to delete elements/IOCs from watchers

This commit is contained in:
Félix Aime 2021-02-16 16:51:36 +01:00
parent af499f3cda
commit 53620b6a0a
3 changed files with 56 additions and 4 deletions

View File

@ -70,7 +70,7 @@ class IOCs(object):
@staticmethod @staticmethod
def delete(ioc_id): def delete(ioc_id):
""" """
Delete an IOC by its id to the database. Delete an IOC by its id in the database.
:return: status of the operation in JSON :return: status of the operation in JSON
""" """
if db.session.query(exists().where(Ioc.id == ioc_id)).scalar(): if db.session.query(exists().where(Ioc.id == ioc_id)).scalar():
@ -82,6 +82,21 @@ class IOCs(object):
return {"status": False, return {"status": False,
"message": "IOC not found"} "message": "IOC not found"}
@staticmethod
def delete_by_value(ioc_value):
"""
Delete an IOC by its value in the database.
:return: status of the operation in JSON
"""
if db.session.query(exists().where(Ioc.value == ioc_value)).scalar():
db.session.query(Ioc).filter_by(value=ioc_value).delete()
db.session.commit()
return {"status": True,
"message": "IOC deleted"}
else:
return {"status": False,
"message": "IOC not found"}
@staticmethod @staticmethod
def search(term): def search(term):
""" """

View File

@ -55,7 +55,7 @@ class WhiteList(object):
@staticmethod @staticmethod
def delete(elem_id): def delete(elem_id):
""" """
Delete an element by its id to the database. Delete an element by its id in the database.
:return: status of the operation in a dict :return: status of the operation in a dict
""" """
if db.session.query(exists().where(Whitelist.id == elem_id)).scalar(): if db.session.query(exists().where(Whitelist.id == elem_id)).scalar():
@ -67,6 +67,21 @@ class WhiteList(object):
return {"status": False, return {"status": False,
"message": "Element not found"} "message": "Element not found"}
@staticmethod
def delete_by_value(elem_value):
"""
Delete an element by its value in the database.
:return: status of the operation in a dict
"""
if db.session.query(exists().where(Whitelist.element == elem_value)).scalar():
db.session.query(Whitelist).filter_by(element=elem_value).delete()
db.session.commit()
return {"status": True,
"message": "Element deleted"}
else:
return {"status": False,
"message": "Element not found"}
@staticmethod @staticmethod
def search(element): def search(element):
""" """

View File

@ -44,7 +44,11 @@ def watch_iocs():
try: try:
res = requests.get(w["url"], verify=False) res = requests.get(w["url"], verify=False)
if res.status_code == 200: if res.status_code == 200:
iocs_list = json.loads(res.content)["iocs"] content = json.loads(res.content)
iocs_list = content["iocs"] if "iocs" in content else [
]
to_delete = content["to_delete"] if "to_delete" in content else [
]
else: else:
w["status"] = False w["status"] = False
except: except:
@ -58,6 +62,13 @@ def watch_iocs():
except: except:
continue continue
for ioc in to_delete:
try:
iocs.delete_by_value(ioc["value"])
w["status"] = True
except:
continue
# If at least one URL haven't be parsed, let's retry in 1min. # If at least one URL haven't be parsed, let's retry in 1min.
if False in [w["status"] for w in watchers]: if False in [w["status"] for w in watchers]:
time.sleep(60) time.sleep(60)
@ -83,7 +94,11 @@ def watch_whitelists():
try: try:
res = requests.get(w["url"], verify=False) res = requests.get(w["url"], verify=False)
if res.status_code == 200: if res.status_code == 200:
elements = json.loads(res.content)["elements"] content = json.loads(res.content)
elements = content["elements"] if "elements" in content else [
]
to_delete = content["to_delete"] if "to_delete" in content else [
]
else: else:
w["status"] = False w["status"] = False
except: except:
@ -96,6 +111,13 @@ def watch_whitelists():
except: except:
continue continue
for elem in to_delete:
try:
whitelist.delete_by_value(elem["element"])
w["status"] = True
except:
continue
if False in [w["status"] for w in watchers]: if False in [w["status"] for w in watchers]:
time.sleep(60) time.sleep(60)
else: else: